Unsafe HTML · Comrak

$ comrak --unsafe -t commonmark -t xml

<script>
alert('xyz');
</script>

Possibly <marquee>annoying</marquee>.

[Dangerous](javascript:alert(document.cookie)).

[Safe](http://commonmark.org).

<script>
alert('xyz');
</script>
<p>Possibly <marquee>annoying</marquee>.</p>
<p><a href="javascript:alert(document.cookie)">Dangerous</a>.</p>
<p><a href="http://commonmark.org">Safe</a>.</p>

<script>
alert('xyz');
</script>

Possibly <marquee>annoying</marquee>.

[Dangerous](javascript:alert\(document.cookie\)).

[Safe](http://commonmark.org).

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE document SYSTEM "CommonMark.dtd">
<document xmlns="http://commonmark.org/xml/1.0">
  <html_block xml:space="preserve">&lt;script&gt;
alert('xyz');
&lt;/script&gt;
</html_block>
  <paragraph>
    <text xml:space="preserve">Possibly </text>
    <html_inline xml:space="preserve">&lt;marquee&gt;</html_inline>
    <text xml:space="preserve">annoying</text>
    <html_inline xml:space="preserve">&lt;/marquee&gt;</html_inline>
    <text xml:space="preserve">.</text>
  </paragraph>
  <paragraph>
    <link destination="javascript:alert(document.cookie)" title="">
      <text xml:space="preserve">Dangerous</text>
    </link>
    <text xml:space="preserve">.</text>
  </paragraph>
  <paragraph>
    <link destination="http://commonmark.org" title="">
      <text xml:space="preserve">Safe</text>
    </link>
    <text xml:space="preserve">.</text>
  </paragraph>
</document>

$ comrak -t commonmark -t xml

<script>
alert('xyz');
</script>

Possibly <marquee>annoying</marquee>.

[Dangerous](javascript:alert(document.cookie)).

[Safe](http://commonmark.org).

<!-- raw HTML omitted -->
<p>Possibly <!-- raw HTML omitted -->annoying<!-- raw HTML omitted -->.</p>
<p><a href="">Dangerous</a>.</p>
<p><a href="http://commonmark.org">Safe</a>.</p>

<script>
alert('xyz');
</script>

Possibly <marquee>annoying</marquee>.

[Dangerous](javascript:alert\(document.cookie\)).

[Safe](http://commonmark.org).

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE document SYSTEM "CommonMark.dtd">
<document xmlns="http://commonmark.org/xml/1.0">
  <html_block xml:space="preserve">&lt;script&gt;
alert('xyz');
&lt;/script&gt;
</html_block>
  <paragraph>
    <text xml:space="preserve">Possibly </text>
    <html_inline xml:space="preserve">&lt;marquee&gt;</html_inline>
    <text xml:space="preserve">annoying</text>
    <html_inline xml:space="preserve">&lt;/marquee&gt;</html_inline>
    <text xml:space="preserve">.</text>
  </paragraph>
  <paragraph>
    <link destination="javascript:alert(document.cookie)" title="">
      <text xml:space="preserve">Dangerous</text>
    </link>
    <text xml:space="preserve">.</text>
  </paragraph>
  <paragraph>
    <link destination="http://commonmark.org" title="">
      <text xml:space="preserve">Safe</text>
    </link>
    <text xml:space="preserve">.</text>
  </paragraph>
</document>

$ comrak --unsafe -t commonmark -t xml

![png](data:image/png;base64,AAAA) ![html](data:text/html;base64,AAAA)

<p><img src="data:image/png;base64,AAAA" alt="png" /> <img src="data:text/html;base64,AAAA" alt="html" /></p>

![png](data:image/png;base64,AAAA) ![html](data:text/html;base64,AAAA)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE document SYSTEM "CommonMark.dtd">
<document xmlns="http://commonmark.org/xml/1.0">
  <paragraph>
    <image destination="data:image/png;base64,AAAA" title="">
      <text xml:space="preserve">png</text>
    </image>
    <text xml:space="preserve"> </text>
    <image destination="data:text/html;base64,AAAA" title="">
      <text xml:space="preserve">html</text>
    </image>
  </paragraph>
</document>

$ comrak -t commonmark -t xml

![png](data:image/png;base64,AAAA) ![html](data:text/html;base64,AAAA)

<p><img src="data:image/png;base64,AAAA" alt="png" /> <img src="" alt="html" /></p>

![png](data:image/png;base64,AAAA) ![html](data:text/html;base64,AAAA)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE document SYSTEM "CommonMark.dtd">
<document xmlns="http://commonmark.org/xml/1.0">
  <paragraph>
    <image destination="data:image/png;base64,AAAA" title="">
      <text xml:space="preserve">png</text>
    </image>
    <text xml:space="preserve"> </text>
    <image destination="data:text/html;base64,AAAA" title="">
      <text xml:space="preserve">html</text>
    </image>
  </paragraph>
</document>